Splunk Search

how to avoid auto extraction in quotes?

yasein
Engager

I have logs like
msg="some string here method=aaaa" method=bbbb
splunk may extract method=aaaa out of the quoted string, how can I avoid this?

Thanks

0 Karma
1 Solution

woodcock
Esteemed Legend

So far as I.know, you cannot. Your only option is to set KV_MODE=none in props.conf and then do the field extractions yourself and build them explicitly so each does the corrrect thing in context.

View solution in original post

jacobpevans
Motivator

I know this is old, but I figured out a workaround for this. If you have control over the inputs, change it to be like this:

msg="some string here method~aaaa" method=bbbb

And then in your search, change it back, e.g.

| eval msg = replace(msg, "~", "\"")

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma

woodcock
Esteemed Legend

So far as I.know, you cannot. Your only option is to set KV_MODE=none in props.conf and then do the field extractions yourself and build them explicitly so each does the corrrect thing in context.

yasein
Engager

Thanks.
THe none KV_MODE solved my problem

props.conf

KV_MODE = none
REPORT-field_extract                            = field_extract

transforms.conf

[field_extract]
DELIMS = " ", "="
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...